Method, device, medium and product for hierarchical loading and display of large-scale spatiotemporal data

Abstract

The application discloses a large-scale space-time data layered loading and display method, equipment, medium and product, relates to the technical field of data processing and geographic information visualization, and comprises the following steps: acquiring network security situation data, calculating the display level of each node data based on the key degree of node attribute, and calculating the face number of each node data based on the plane subdivision of the longitude and latitude network; based on the display level and the face number, the memory pool is used to organize and dynamically schedule the visualized data after the subdivision; based on GIS, the multi-thread mode is used to load and draw the scene nodes of the dynamically scheduled data, and the state of the scene nodes is updated through collision detection in the rendering and display process. The application solves the memory pressure, operation lag and "mashed ball" overlapping phenomenon caused by the simultaneous loading of massive nodes, realizes efficient memory scheduling and layered and fragmented visualization of large-scale network situation data, and improves the visual experience of users.

Description

Technical Field

[0001] This invention relates to the field of data processing and geographic information visualization technology, specifically to methods, devices, media, and products for large-scale spatiotemporal data layered loading and display. Background Technology

[0002] The statements in this section are provided only as background information in connection with this disclosure and may not constitute prior art.

[0003] With the massive growth of network situation spatiotemporal data, visualization and scheduling technologies for large-scale network security situation data have received widespread attention. Existing technologies mainly focus on loading and displaying network situation spatiotemporal data using methods such as multidimensional data formats, public dataset computing power, and data cube standardization. These technologies typically involve transforming complex temporal, spatial, and attribute information into intuitive graphics or images, thereby enabling the loading and display of cyberspace situation data. Currently, the existing technical solutions associated with this invention mainly include the following:

[0004] 1. Multidimensional data display methods based on data models and organizations

[0005] Multidimensional data display methods based on data models and organizations address the fundamental problem of how to efficiently and rationally store and manage massive amounts of data with multiple attributes, including time and space. Traditional file formats cannot meet the needs of rapid analysis and querying of massive spatiotemporal data. The goal of data models is to transform this data into a structured and computationally savvy form. By using MDD technology to treat time, space, and spectrum as equal dimensions, and by designing five multidimensional storage structures (including TSB, TSP, BIP, BIL, and BSQ), the optimal storage method can be selected according to different analysis scenarios.

[0006] By establishing a unified logical data model that not only includes traditional grid data but also inherits vector, field, and thematic attributes, a true data cube is formed, enabling the loading and display of multidimensional data.

[0007] 2. Display method based on MARS and Open Earth Engine

[0008] The display method based on MARS and the Open Earth Engine is a full-chain data display method specifically designed for MDD data format. It achieves an autonomous and controllable technological closed loop from data generation, management, processing to visualization. Deeply optimized with the MDD storage structure, it delivers extremely high performance for specific data displays. Simultaneously, by building an open and flexible national-level spatiotemporal information service display platform through the Open Earth Engine, it not only provides data cube display capabilities but also integrates an independent deep learning framework, supporting complex AI analysis tasks.

[0009] Open Earth Engine integrates massive public datasets and cloud computing capabilities into a single online, user-friendly interface. Users can visualize global-scale data in the cloud simply by writing basic JavaScript and Python code, without needing to download data. This lowers the technical and financial barriers to displaying spatiotemporal big data, enabling researchers to utilize world-class computing and data resources for large-scale spatiotemporal data visualization.

[0010] 3. Data display methods based on spatiotemporal big data and "BeiDou+"

[0011] Data display methods based on spatiotemporal big data and "BeiDou+" can directly serve users, solving the problem of how to extract information from spatiotemporal data, discover patterns to form knowledge, and ultimately load and display large-scale data. The core idea of ​​data display methods based on spatiotemporal big data and "BeiDou+" is to go beyond map display and deeply integrate visualization, data mining, artificial intelligence, and cyberspace data. It emphasizes multi-source data fusion and transforms data into situational awareness for loading and display through correlation analysis, spatiotemporal pattern mining, and simulation.

[0012] By utilizing deep learning models to directly learn complex nonlinear features from spatial data, more accurate land cover classification, transformation detection, and forecasting can be achieved. Based on existing spatiotemporal data context information, data can be intelligently repaired and filled, providing support for the loading and display of large-scale spatiotemporal data.

[0013] However, the current state of the above technologies has the following drawbacks, including:

[0014] 1. Disadvantages of multidimensional data display methods based on data models and organizations

[0015] The determination of multidimensional data display methods based on data models and organizations is constrained by the complexity and fragmentation of data, which limits the efficiency of loading and displaying large-scale spatiotemporal data. MDD has a high technical threshold. The species storage structure of MDD and the multidimensional data operation of data cubes require profound professional knowledge and data processing skills. There are huge challenges in correctly understanding and using these data models and applying them to the loading and display of spatiotemporal data.

[0016] Meanwhile, multidimensional data display methods based on data models and organizations suffer from huge data preprocessing costs. Cleaning, formatting, aligning, and importing raw, scattered multi-source data into the data model is an extremely time-consuming, labor-intensive, and error-prone process, which greatly reduces the efficiency of loading and displaying large-scale spatiotemporal data.

[0017] 2. Disadvantages of the display method based on MARS and Open Earth Engine

[0018] Display methods based on MARS and the Open Earth Engine introduce new problems such as resources, costs, and dependencies. The risks of resource monopoly and technology dependence mean that cloud platforms, represented by GEE, concentrate their core computing power, storage, and core algorithms in the hands of a few technology giants or national institutions. This may lead to risks of technology dependence and supplier lock-in, with extremely high migration costs, resulting in many uncertainties in the display and loading of large-scale spatiotemporal data.

[0019] Meanwhile, display methods based on MARS and the Open Earth Engine also face the challenge of independent control. For domestic platforms such as OGE and MARS, although they have achieved technological independence, their data ecosystem, algorithm richness and community activity still lag behind GEE. How to avoid technological barriers and achieve a breakthrough in technological independence and control has become a challenge and difficulty for display methods based on MARS and the Open Earth Engine.

[0020] 3. Disadvantages of data display methods based on spatiotemporal big data and "BeiDou+"

[0021] Data display methods based on spatiotemporal big data and "BeiDou+" face challenges of "visual overload" and cognitive barriers. When a system view displays too much information across a single screen, it leads to visual confusion and cognitive burden, preventing users from grasping key information. This results in information overload and failure to effectively communicate the information. Furthermore, the results of advanced analytics often require specialized cyberspace knowledge for proper interpretation. A lack of effective explanation and guidance can lead to misunderstandings or a lack of trust in the data displayed by decision-makers.

[0022] In addition, data display methods based on spatiotemporal big data and "BeiDou+" are highly dependent on high-quality data. Common noise, missing data and imbalance in spatiotemporal data can seriously affect the accuracy and reliability of AI models. Insufficient generalization ability makes it impossible to make decisions or explanations, which leads to low accuracy in loading and displaying large-scale spatiotemporal data. Summary of the Invention

[0023] The purpose of this invention is to address the challenges of efficiently and intuitively displaying various types of content involving large-scale nodes when presenting real-time dynamic content. This is particularly relevant when initial data such as jump servers, botnets, and victim targets only contain IP addresses, lacking latitude and longitude coordinates. Botnets, in particular, can number in the millions. Even if node latitude and longitude coordinates are obtained through IP-Geo conversion, the inability to pre-calculate and set the scale level means that all data must be loaded onto the GIS system during display, leading to clutter and other issues caused by the simultaneous loading of numerous geographically similar or identical nodes. This invention provides a method, device, medium, and product for layered loading and display of large-scale spatiotemporal data. It pre-sets the data tiles and scale levels through divisions such as country, province, city, street, and road, enabling the geographic data to be loaded in layers. Collision detection prevents the obscuring of similar graphic elements, icons, and text. This allows large-scale network situational data to be loaded in layers through reasonable data processing and display methods, avoiding memory pressure, display chaos, and operational lag caused by simultaneous loading of massive amounts of data, and providing a better and clearer user visual experience.

[0024] The technical solution of the present invention is as follows:

[0025] Methods for layered loading and display of large-scale spatiotemporal data include:

[0026] Step S1: Obtain network security situation data and perform situation data segmentation processing on the network security situation data; the situation data segmentation processing includes: calculating the display level of each node data in the network security situation data based on the criticality of node attributes, and calculating the patch number of each node data based on the latitude and longitude grid planar segmentation.

[0027] Step S2: Based on the display level and the patch number, a memory pool is used to organize and dynamically schedule the network security situation data after the segmentation process for visualization.

[0028] Step S3: Based on the Geographic Information System (GIS), a multi-threaded approach is used to load and draw scene nodes of the dynamically scheduled network security situation data. During the rendering and display process, the state of the scene nodes is updated through collision detection to realize the dynamic loading and hierarchical and segmented visualization display of the network security situation data in geographic space.

[0029] Furthermore, the calculation of the display level of each node data in the network security situation data based on the criticality of node attributes includes the following steps:

[0030] Analyze the classification results of the network security situation data to obtain situation factors that determine the importance of node elements;

[0031] The specific types of the situation factors are assigned levels according to a priority rule to obtain the grade value of each situation factor.

[0032] A weight matrix is ​​constructed based on the weights given by experts for the situation factors, and the weight coefficients corresponding to each situation factor are determined based on the weight matrix.

[0033] The weighted values ​​of the situation factors are multiplied by their corresponding weight coefficients and then summed to obtain the weighted values ​​of the corresponding node data.

[0034] Based on the weighted maximum and weighted minimum values ​​of all node data, positive integers are selected to calculate the weighted value interval and range. The display priority of the node data is determined based on the weighted value and the range of the corresponding node data, and the display priority is used as the display level.

[0035] Furthermore, the calculation of the patch number of each node data based on the latitude and longitude grid planar subdivision includes the following steps:

[0036] Obtain the latitude and longitude coordinates of the node data. If the node data lacks latitude and longitude records, then the location information is extracted based on the location field and converted into the latitude and longitude coordinates through IP-GEO conversion.

[0037] Establish a correspondence rule between display level and subdivision unit size, and determine the corresponding patch latitude and longitude difference based on the display level of the node data. The patch latitude and longitude difference includes longitude difference. and latitude difference ;

[0038] The patch number is calculated based on the latitude and longitude coordinates and the latitude and longitude difference of the patch. The patch number includes the patch row and column number. and The calculation formula is as follows:

[0039]

[0040]

[0041] in:

[0042] Represents longitude;

[0043] Represents latitude;

[0044] This represents the display level corresponding to the node data;

[0045] Indicates the rounding operation;

[0046] and The display levels are respectively The maximum row number and the maximum column number.

[0047] Furthermore, the organization and dynamic scheduling of the visualized network security situation data using a memory pool includes the following steps:

[0048] Create a fixed-size memory pool and use the segmented network security situation data as situation data blocks to be loaded.

[0049] The memory pool is organized and managed based on the 2Q algorithm; wherein, the 2Q algorithm includes maintaining a historical data queue based on the first-in-first-out (FIFO) rule and a cache queue based on the least recently used (LRU) rule.

[0050] When the remaining memory space in the memory pool is insufficient to store the situation data block loaded in a single instance, the queue access mechanism of the 2Q algorithm is triggered to remove the least frequently used situation data block from the memory pool until the remaining memory space in the memory pool is sufficient to store the situation data block extracted this time.

[0051] Furthermore, the scenario nodes of the dynamically scheduled network security situation data are loaded using a multi-threaded approach, including the following steps:

[0052] The number of threads in the thread pool is determined based on the current number of CPUs on the host, and the thread pool is initialized.

[0053] The scene nodes are generated based on the network security situation data after dynamic scheduling. A fixed number of scene nodes are created each time a task is loaded, and the newly added loading tasks are stored in the task queue.

[0054] An idle thread is allocated from the thread pool to execute the loading tasks in the task queue; when a loading task is completed, the idle thread continues to extract the next loading task from the task queue;

[0055] When the task queue is empty, the threads in the thread pool enter a sleep state to wait for new tasks to be loaded, thus avoiding frequent creation and destruction of threads.

[0056] Furthermore, the process of drawing scene nodes on the dynamically scheduled network security situation data includes an initialization phase and a frame loop phase.

[0057] The initialization phase includes: completing viewport initialization, which includes initializing the message event queue and the scene roamer; creating a camera and device context; setting the initial position and size of the window; and creating a main camera for scene display and rendering.

[0058] The frame loop phase includes: adding the loaded scene nodes to the scene root node according to the layer set; under the main camera, executing message event processing, scheduling data update, business logic update, scene animation update, physics engine update, node rendering state update, scene graph culling optimization, pre-rendering, deferred rendering, and post-processing in sequence through frame loop, so as to render and respond to events for all the scene nodes under the scene root node.

[0059] Furthermore, updating the state of the scene nodes through collision detection during the rendering and display process includes:

[0060] When rendering and displaying the network security situation data, the collision detection identifies the overlapping and occlusion phenomenon between graphic elements, icons, or text in key areas due to the dense distribution of nodes, and updates the display status of scene nodes that cause the overlapping and occlusion phenomenon according to the preset update rules to avoid occlusion.

[0061] When a linear element is detected but its associated point elements at both ends are not displayed, resulting in a broken connection, the scene node status of the linear element and its associated point elements at both ends is updated synchronously according to the update rules.

[0062] The present invention also proposes an electronic device, comprising:

[0063] At least one processor; and a memory communicatively connected to said at least one processor;

[0064] The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the instructions stored in the memory to perform the method described above.

[0065] The present invention also proposes a computer-readable storage medium for storing instructions that, when executed, cause the method described above to be implemented.

[0066] The present invention also proposes a computer program product, which implements the above-described method when executed by a processor.

[0067] Compared with existing technologies, the advantages of this invention are:

[0068] 1. A precise deep segmentation mechanism eliminates the "clumping" phenomenon and visual overload; This invention achieves hierarchical and segmented processing of massive situational data by combining node attribute criticality (situational factor weight) with latitude and longitude grid planar segmentation. Compared to the severe "clumping" phenomenon caused by loading millions of scale-less nodes into the GIS system at once in traditional technologies, this invention can pre-calculate and determine the display level and patch number of each node under different spatial grids, effectively avoiding visual confusion and cognitive barriers in information display, and greatly improving the identifiability of high-value target nodes.

[0069] 2. Memory pool scheduling based on the 2Q algorithm significantly reduces memory pressure and fragmentation. Addressing the risk of memory overflow when loading massive amounts of spatiotemporal data, this invention employs a fixed-size memory pool combined with the 2Q algorithm (including a FIFO historical queue and an LRU cache queue) for the organization and dynamic scheduling of visualized data. This mechanism not only effectively controls system memory consumption and reduces memory fragmentation and leaks, but also specifically overcomes the low data reading efficiency caused by occasional and periodic batch operations on situational data, ensuring smooth allocation of large-scale data within limited memory space.

[0070] 3. Highly efficient multi-threaded concurrency and rendering pipeline, eliminating operational lag; This invention adaptively initializes a thread pool based on the current host CPU count for asynchronous loading of scene nodes. When the task queue is empty, the thread enters sleep mode instead of exiting, completely avoiding the system performance overhead caused by frequent thread creation, destruction, and switching. Simultaneously, combined with a complete frame-loop rendering pipeline covering pre-rendering, deferred rendering, and primitive culling, it significantly improves the concurrent throughput of data parsing and graphics rendering, effectively solving the operational lag problem when dynamically displaying massive amounts of data from the underlying layer.

[0071] 4. Intelligent collision detection and status repair provide an exceptional visualization experience; this invention introduces real-time collision detection and node status update rules during multi-threaded rendering and display. The system can automatically identify and handle occlusion phenomena between graphic elements, icons, or text caused by dense node distribution in key areas, and can simultaneously repair "broken-end" logic errors caused by linear elements being displayed but their associated point elements not being displayed. Through dynamic occlusion avoidance and topology relationship repair, the effective transmission of situational data is ensured, providing users with a clearer, more intuitive, and highly reliable visual experience of network security situational awareness. Attached Figure Description

[0072] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments recorded in the embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0073] Figure 1 This is a schematic diagram illustrating the technical principle of a large-scale spatiotemporal data layered loading and display method provided in an embodiment of the present invention;

[0074] Figure 2 This is a visual data organization and scheduling flowchart provided in an embodiment of the present invention;

[0075] Figure 3 This is a schematic diagram of a 2Q algorithm queue access mechanism provided in an embodiment of the present invention;

[0076] Figure 4 This is a flowchart of scene data loading and drawing based on GIS provided in an embodiment of the present invention;

[0077] Figure 5 This is a schematic diagram illustrating the working principle of scene data initialization provided in an embodiment of the present invention;

[0078] Figure 6 This is a schematic diagram of a scene initialization and rendering process provided in an embodiment of the present invention;

[0079] Figure 7 This is a hardware structure block diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0080] It should be noted that relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0081] The features and performance of the present invention will be further described in detail below with reference to embodiments.

[0082] Example 1

[0083] To address the challenge of real-time display of large-scale cybersecurity situational data on limited memory and displays, this embodiment develops a method for deep segmentation of cybersecurity situational data (i.e., a method for layered loading and display of large-scale spatiotemporal data) that combines different data attribute weights with latitude and longitude grids. By combining a background data segmentation and processing service with a front-end dynamic organization and scheduling plugin, the method achieves dynamic loading and layered visualization of large-scale cybersecurity situational data in geographic space.

[0084] In this embodiment, it should be noted that the visualization of cyberspace situation data based on GIS requires three steps: situation data segmentation and processing, visualization data organization and dynamic scheduling, and GIS-based multi-threaded loading and rendering. This mainly addresses the problems of excessively large data scale, slow loading, and overly dense display.

[0085] Please see Figure 1 In this embodiment, a method for loading and displaying large-scale spatiotemporal data in a layered manner specifically includes the following steps:

[0086] Step S1: Obtain network security situation data and perform situation data segmentation processing on the network security situation data; it should be noted that the situation data segmentation processing reduces the pressure of data organization, scheduling and drawing by performing geographic coordinate completion, classification, hierarchical and fragmentation on the network security situation data; the situation data segmentation processing includes: calculating the display level of each node data in the network security situation data based on the criticality of node attributes, and calculating the patch number of each node data based on latitude and longitude grid planar segmentation;

[0087] Step S2: Based on the display level and the patch number, a memory pool is used to organize and dynamically schedule the network security situation data after the segmentation process for visualization.

[0088] Step S3: Based on the Geographic Information System (GIS), a multi-threaded approach is used to load and draw scene nodes of the dynamically scheduled network security situation data. During the rendering and display process, the state of the scene nodes is updated through collision detection to realize the dynamic loading and hierarchical and segmented visualization display of the network security situation data in geographic space.

[0089] In this embodiment, it should be noted that when the nodes are relatively concentrated, in order to improve the recognizability and aesthetics of the visualized data of various nodes, it is necessary to determine the display level of each node and achieve hierarchical display. The criticality of node attributes is calculated using a weighted analysis method to determine the influencing factors and weight coefficients, and the node display level is calculated by combining expert knowledge.

[0090] In this embodiment, specifically, calculating the display level of each node data in the network security situation data based on the criticality of node attributes includes the following steps:

[0091] The classification results of the network security situation data are analyzed to obtain situation factors that determine the importance of node elements. Specifically, based on the classification results of the network security situation data, the attributes that determine the importance of elements in various types of data are analyzed. Taking security event data as an example, the factors that affect its display priority include event category, security index of defense equipment, key areas, etc.

[0092] The specific categories included in the situation factors are assigned priority values ​​according to a priority rule to obtain the grade value of each situation factor. Specifically, the specific categories included in each situation factor are assigned priority values ​​according to a priority rule. For example, event categories mainly include malicious program events, computer virus events, worm events, Trojan horse events, malicious code events, network attack events (denial-of-service attacks, backdoor attacks, vulnerability attacks, network scanning and eavesdropping, phishing, interference), information destruction events, information content security events, and other events, which can be assigned priority values ​​in the following order: 9>8>7>6>5>4>3>2>1.

[0093] A weight matrix is ​​constructed based on the weights given by experts for the situation factors, and the weight coefficients corresponding to each situation factor are determined based on the weight matrix; specifically, if k experts give weights for n factors, the weight matrix is ​​formed according to the given weights. ,in The weights are set based on expert knowledge, which is somewhat subjective, and are adjusted according to actual business needs.

[0094] The weighted value of the corresponding node data is obtained by multiplying the graded value of the situation factor by its corresponding weight coefficient and then summing the results. Specifically, the weighted value of the situation factor is obtained by multiplying the graded value of the situation factor by its corresponding weight and then summing the results. For example, the value of factor b is... , ,…, (where n is the number of discrete values ​​of the factor), and the resulting value is the weighted value corresponding to that node;

[0095] Based on the weighted maximum and weighted minimum values ​​of all node data, positive integers are selected to calculate the weighted value interval and range. The display priority of the corresponding node data is determined based on its weighted value and the range, and this display priority is used as the display level. That is, based on the weighted maximum value... and minimum value Select a suitable positive integer p, calculate the weighted interval and range of each display priority level, and determine the display priority based on the weighted value and range.

[0096] In this embodiment, it should be noted that the latitude and longitude grid-based network security situation data planar partitioning method is the basis for dynamic target scheduling and visualization. Taking into account the target's identifiability, aesthetics, and performance requirements, planar partitioning level parameters are set, the partitioning range size and number of each level are calculated, node data is processed according to the set partitioning rules, and the patch number of each node is identified, which facilitates data organization and dynamic scheduling in memory.

[0097] In this embodiment, specifically, the calculation of the patch number of each node data based on the latitude and longitude grid planar subdivision includes the following steps:

[0098] Obtain the latitude and longitude coordinates of the node data. If the node data lacks latitude and longitude records, the location information is extracted and converted into latitude and longitude coordinates through IP-GEO conversion or based on the location field; specifically, if there are no latitude and longitude records in the node attributes, its rough location information can be obtained based on IP-GEO conversion or the country and city fields.

[0099] Establish a correspondence rule between display level and subdivision unit size (taking a five-level display level as an example, the rule is shown in Table 1). Determine the corresponding patch latitude and longitude difference based on the display level of the node data. The patch latitude and longitude difference includes longitude difference. and latitude difference ;

[0100] Table 1 shows the display level and subdivision unit rules.

[0101]

[0102] The patch number is calculated based on the latitude and longitude coordinates and the latitude and longitude difference of the patch. The patch number includes the patch row and column number. and The calculation formula is as follows:

[0103]

[0104]

[0105] in:

[0106] Represents longitude;

[0107] Represents latitude;

[0108] This represents the display level corresponding to the node data. ;

[0109] Indicates the rounding operation;

[0110] and The display levels are respectively The maximum row number and the maximum column number.

[0111] In this embodiment, it should be noted that the situational awareness data organization and scheduling improves memory utilization efficiency and reduces memory fragmentation and leakage issues by designing a reasonable data storage structure and using a memory pool to store and manage network situational awareness data. The process is as follows: Figure 2 As shown.

[0112] Visual data memory management and dynamic scheduling are key operations for realizing real-time visualization of large-scale situational data. The situational data after being segmented needs to be loaded into memory before being drawn. Memory organization and management are carried out. Combined with LRU (Least Recently Used Page Replacement) algorithm, the segmented situational data can be presented smoothly in a limited memory space.

[0113] The LRU algorithm prioritizes the least recently used page when selecting a page to swap out, thus mitigating memory pressure caused by prolonged system use. To address the inefficiency of data retrieval due to occasional and periodic batch operations on situational data blocks, this embodiment employs a variant of LRU—the 2Q (Two Queens) algorithm. The 2Q algorithm maintains an additional queue using a FIFO (First In First Out) rule as the historical data list. Memory management in this algorithm involves creating a fixed-size memory pool for storing situational data. When the remaining memory in the pool is insufficient to store a single loaded situational data block, the LRU algorithm deletes the least frequently used block until the memory pool has enough space to store the currently retrieved situational data block. The 2Q algorithm's queue access mechanism is as follows: Figure 3 As shown.

[0114] In this embodiment, specifically, the organization and dynamic scheduling of the network security situation data after segmentation using a memory pool for visualization includes the following steps:

[0115] Create a fixed-size memory pool and use the segmented network security situation data as situation data blocks to be loaded.

[0116] The memory pool is organized and managed based on the 2Q algorithm; wherein, the 2Q algorithm includes maintaining a historical data queue based on the first-in-first-out (FIFO) rule and a cache queue based on the least recently used (LRU) rule.

[0117] When the remaining memory space in the memory pool is insufficient to store the situation data block loaded in a single instance, the queue access mechanism of the 2Q algorithm is triggered to remove the least frequently used situation data block from the memory pool until the remaining memory space in the memory pool is sufficient to store the situation data block extracted this time.

[0118] In this embodiment, it should be noted that the GIS-based multi-threaded loading and rendering reads valid data from the viewport through a data service, uses a thread pool to load scene nodes, and implements operations such as batch rendering of data and updating the state of scene nodes. The process is as follows: Figure 4 As shown.

[0119] In this embodiment, specifically, a multi-threaded approach is used to load the dynamically scheduled network security situation data into scene nodes, including the following steps:

[0120] The number of threads in the thread pool is determined based on the current number of CPUs on the host, and the thread pool is initialized.

[0121] The scene nodes are generated based on the network security situation data after dynamic scheduling. A fixed number of scene nodes are created each time a task is loaded, and the newly added loading tasks are stored in the task queue.

[0122] An idle thread is allocated from the thread pool to execute the loading tasks in the task queue; when a loading task is completed, the idle thread continues to extract the next loading task from the task queue;

[0123] When the task queue is empty, the threads in the thread pool enter a sleep state to wait for new tasks to be loaded, thus avoiding frequent creation and destruction of threads.

[0124] In this embodiment, it should be noted that scene data loading refers to generating a scene node based on the punctuation and lines organized in memory, which is then drawn by the rendering thread. To speed up data display and improve operational smoothness, a thread pool is used to initialize the scene data. Its working principle is as follows: Figure 5 As shown, the thread pool initialization sets the number of threads and thread parameters in the thread pool based on the current number of CPUs on the host. Each time a task is loaded, a fixed number of scene nodes are created, and newly added tasks are stored in a queue. When processing a task, an idle thread is found from the thread pool to perform the tasks in the task queue. After a task is completed, more tasks are retrieved from the queue. When the task queue is empty, the thread sleeps (suspends) and does not exit until a new task arrives. The thread pool can avoid the performance overhead caused by frequent thread switching / creation and destruction, saving system resources.

[0125] In this embodiment, specifically, the drawing of scene nodes on the dynamically scheduled network security situation data includes an initialization phase and a frame looping phase.

[0126] The initialization phase includes: completing viewport initialization, which includes initializing the message event queue and the scene roamer; creating a camera and device context; setting the initial position and size of the window; and creating a main camera for scene display and rendering.

[0127] The frame loop phase includes: adding the loaded scene nodes to the scene root node according to the layer set; under the main camera, executing message event processing, scheduling data update, business logic update, scene animation update, physics engine update, node rendering state update, scene graph culling optimization, pre-rendering, deferred rendering, and post-processing in sequence through frame loop, so as to render and respond to events for all the scene nodes under the scene root node.

[0128] In this embodiment, it should be noted that the situational data read from the database is loaded into the scene data via multi-threaded loading, added to the scene root node according to the layer set, and the rendering thread renders all nodes under the scene root node every frame. The scene initialization and rendering process is as follows: Figure 6 As shown; the specific operation steps are as follows:

[0129] a) Initialization mainly completes the viewport initialization, including the initialization of the message event queue and the scene roamer;

[0130] b) Create a camera and device context, complete the initial window position and size settings, and create the main camera for scene display and rendering;

[0131] c) The frame loop includes message event handling, scheduling data updates, business logic updates, scene animation updates, physics engine updates, node rendering state updates, scene graph culling optimization, pre-rendering, deferred rendering, and post-rendering effects, used to implement scene graphics drawing, updating, and response to various events.

[0132] In this embodiment, specifically, updating the state of the scene nodes through collision detection during the rendering and display process includes:

[0133] When rendering and displaying the network security situation data, the collision detection identifies the overlapping and occlusion phenomenon between graphic elements, icons, or text in key areas due to the dense distribution of nodes, and updates the display status of scene nodes that cause the overlapping and occlusion phenomenon according to the preset update rules to avoid occlusion.

[0134] When a linear element is detected but its associated point elements at both ends are not displayed, resulting in a broken connection, the scene node status of the linear element and its associated point elements at both ends is updated synchronously according to the update rules.

[0135] In this embodiment, it should be noted that the basic situation map displayed by loading and rendering scene data often has unreasonable display requirements. For example, the military symbols in some key areas are too dense, resulting in overlay, or the connection relationship is broken when the military symbols at both ends are displayed. It is necessary to set update rules to update the status of scene nodes according to user needs.

[0136] Based on the same technical concept, embodiments of the present invention also provide an electronic device that can implement the large-scale spatiotemporal data layered loading and display method provided in the above embodiments of the present invention. In one embodiment, the electronic device can be a server, a terminal device, or other electronic devices. Figure 7 As shown, the electronic device may include:

[0137] At least one processor and a memory connected to the at least one processor. In this embodiment of the invention, the specific connection medium between the processor and the memory is not limited. Figure 7 The example used is the connection between the processor and memory via a bus. The bus... Figure 7 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. Buses can be categorized into address buses, data buses, control buses, etc., but for ease of representation, [the specific bus type is not shown here]. Figure 7 The processor is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, a processor can also be called a controller; there are no restrictions on the name.

[0138] In this embodiment of the invention, the memory stores instructions executable by at least one processor. By executing the instructions stored in the memory, the at least one processor can perform the large-scale spatiotemporal data hierarchical loading and display method discussed above. The processor can implement... Figure 7 The functions of each module in the device shown.

[0139] The processor is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory and calling data stored in memory, it can monitor the device's various functions and process data, thereby enabling overall monitoring of the device.

[0140] In an alternative design, the processor may include one or more processing units. The processor may integrate an application processor and a modem processor, wherein the application processor primarily handles the operating system, user interface, and applications, while the modem processor primarily handles wireless communication. It is understood that the modem processor may also not be integrated into the processor. In some embodiments, the processor and memory may be implemented on the same chip; in some embodiments, they may also be implemented separately on separate chips.

[0141] The processor can be a general-purpose processor, such as a CPU, digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the large-scale spatiotemporal data layered loading and display method disclosed in the embodiments of this invention can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0142] Memory, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory can include at least one type of storage medium, such as flash memory, hard disk, multimedia cards, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), and electrically erasable programmable read-only memory (EPROM). Only memory (EEPROM), magnetic storage, magnetic disks, optical disks, etc. A memory is any other medium capable of carrying or storing desired program code in the form of instructions or data structures, and accessible by a computer, but is not limited thereto. The memory in embodiments of this invention can also be a circuit or any other device capable of performing storage functions for storing program instructions and / or data.

[0143] By designing and programming the processor, the code corresponding to the large-scale spatiotemporal data layered loading and display method described in the foregoing embodiments can be embedded into the chip, thereby enabling the chip to execute the steps of the method described in the foregoing embodiments during runtime. How to design and program the processor is a technique well known to those skilled in the art, and will not be elaborated here.

[0144] Based on the same inventive concept, embodiments of the present invention also provide a storage medium storing computer instructions that, when executed on a computer, cause the computer to perform the large-scale spatiotemporal data layered loading and display method described above.

[0145] In some alternative embodiments, the present invention also provides that various aspects of the method for loading and displaying large-scale spatiotemporal data in a layered manner can also be implemented as a program product, which includes program code that, when the program product is run on a device, causes the control device to perform the steps in the method for loading and displaying large-scale spatiotemporal data in a layered manner according to various exemplary embodiments of the present invention as described above.

[0146] It should be noted that although several units or sub-units of the apparatus have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of the invention, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units. Furthermore, although the operation of the method of the invention is described in a specific order in the drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0147] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0148] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a server, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0149] Program code for performing the operations of this invention can be written using any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0150] In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0151] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0152] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0153] In addition, in some embodiments, a computer program product is proposed, which, when executed by a processor, implements the above-described method for loading and displaying large-scale spatiotemporal data in layers.

[0154] The embodiments described above merely illustrate specific implementation methods of this application, and while the descriptions are detailed and specific, they should not be construed as limiting the scope of protection of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the technical solution of this application, and these modifications and improvements all fall within the scope of protection of this application.

[0155] This background section is provided to generally present the context of the invention. The work of the currently named inventors, the work to the extent described in this background section, and aspects of this section that did not constitute prior art at the time of application are neither expressly nor impliedly acknowledged as prior art to the invention.

Claims

1. A method for layered loading and display of large-scale spatiotemporal data, characterized in that, include: Step S1: Obtain network security situation data and perform situation data segmentation processing on the network security situation data; The situational data segmentation process includes: calculating the display level of each node data in the network security situational data based on the criticality of node attributes, and calculating the patch number of each node data based on the planar segmentation of latitude and longitude grid. Step S2: Based on the display level and the patch number, a memory pool is used to organize and dynamically schedule the network security situation data after the segmentation process for visualization. Step S3: Based on the Geographic Information System (GIS), a multi-threaded approach is used to load and draw scene nodes of the dynamically scheduled network security situation data. During the rendering and display process, the state of the scene nodes is updated through collision detection to realize the dynamic loading and hierarchical and segmented visualization display of the network security situation data in geographic space. The calculation of the patch number of each node data based on the latitude and longitude grid includes the following steps: Obtain the latitude and longitude coordinates of the node data. If the node data lacks latitude and longitude records, then the location information is extracted based on the location field and converted into the latitude and longitude coordinates through IP-GEO conversion. Establish a correspondence rule between display level and subdivision unit size, and determine the corresponding patch latitude and longitude difference based on the display level of the node data. The patch latitude and longitude difference includes longitude difference. and latitude difference ; The patch number is calculated based on the latitude and longitude coordinates and the latitude and longitude difference of the patch. The patch number includes the patch row and column number. and The calculation formula is as follows: in: Represents longitude; Represents latitude; This represents the display level corresponding to the node data; Indicates the rounding operation; and The display levels are respectively The maximum row number and the maximum column number; The method of using a memory pool to organize and dynamically schedule the visualized network security situation data after it has been segmented includes the following steps: Create a fixed-size memory pool and use the segmented network security situation data as situation data blocks to be loaded. The memory pool is organized and managed based on the 2Q algorithm; wherein, the 2Q algorithm includes maintaining a historical data queue based on the first-in-first-out (FIFO) rule and a cache queue based on the least recently used (LRU) rule. When the remaining memory space in the memory pool is insufficient to store the situation data block loaded in a single instance, the queue access mechanism of the 2Q algorithm is triggered to remove the least frequently used situation data block from the memory pool until the remaining memory space in the memory pool is sufficient to store the situation data block extracted this time.

2. The method for layered loading and display of large-scale spatiotemporal data according to claim 1, characterized in that, The calculation of the display level of each node data in the network security situation data based on the criticality of node attributes includes the following steps: Analyze the classification results of the network security situation data to obtain situation factors that determine the importance of node elements; The specific types of the situation factors are assigned levels according to a priority rule to obtain the grade value of each situation factor. A weight matrix is ​​constructed based on the weights given by experts for the situation factors, and the weight coefficients corresponding to each situation factor are determined based on the weight matrix. The weighted values ​​of the situation factors are multiplied by their corresponding weight coefficients and then summed to obtain the weighted values ​​of the corresponding node data. Based on the weighted maximum and weighted minimum values ​​of all node data, positive integers are selected to calculate the weighted value interval and range. The display priority of the node data is determined based on the weighted value and the range of the corresponding node data, and the display priority is used as the display level.

3. The method for layered loading and display of large-scale spatiotemporal data according to claim 1, characterized in that, The process of loading scenario nodes into the dynamically scheduled network security situation data using a multi-threaded approach includes the following steps: The number of threads in the thread pool is determined based on the current number of CPUs on the host, and the thread pool is initialized. The scene nodes are generated based on the network security situation data after dynamic scheduling. A fixed number of scene nodes are created each time a task is loaded, and the newly added loading tasks are stored in the task queue. An idle thread is allocated from the thread pool to execute the loading tasks in the task queue; when a loading task is completed, the idle thread continues to extract the next loading task from the task queue; When the task queue is empty, the threads in the thread pool enter a sleep state to wait for new tasks to be loaded, thus avoiding frequent creation and destruction of threads.

4. The method for layered loading and display of large-scale spatiotemporal data according to claim 1, characterized in that, The process of drawing scene nodes on the dynamically scheduled network security situation data includes an initialization phase and a frame loop phase. The initialization phase includes: completing viewport initialization, which includes initializing the message event queue and the scene roamer; creating a camera and device context; setting the initial position and size of the window; and creating a main camera for scene display and rendering. The frame loop phase includes: adding the loaded scene nodes to the scene root node according to the layer set; under the main camera, executing message event processing, scheduling data update, business logic update, scene animation update, physics engine update, node rendering state update, scene graph culling optimization, pre-rendering, deferred rendering, and post-processing in sequence through frame loop, so as to render and respond to events for all the scene nodes under the scene root node.

5. The method for layered loading and display of large-scale spatiotemporal data according to claim 1, characterized in that, The step of updating the state of the scene nodes through collision detection during the rendering and display process includes: When rendering and displaying the network security situation data, the collision detection identifies the overlapping and occlusion phenomenon between graphic elements, icons, or text in key areas due to the dense distribution of nodes, and updates the display status of scene nodes that cause the overlapping and occlusion phenomenon according to the preset update rules to avoid occlusion. When a linear element is detected but its associated point elements at both ends are not displayed, resulting in a broken connection, the scene node status of the linear element and its associated point elements at both ends is updated synchronously according to the update rules.

6. An electronic device, characterized in that, include: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores instructions executable by the at least one processor, which executes the instructions stored in the memory to perform the method as described in any one of claims 1-5.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store instructions that, when executed, cause the method as described in any one of claims 1-5 to be implemented.

8. A computer program product, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1-5.

Images